This vulnerability (CWE-939) in Zoom Workplace arises from improper authorization checks in the handler for a custom URL scheme. It affects Zoom Workplace versions prior to 7.0.4 on Android and prior to 7.0.3 on iOS. Exploitation could allow an unauthenticated attacker to escalate privileges through network access. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, low attack complexity, and no user interaction required. Confidentiality and integrity impacts are high, with no availability impact. No official patch or remediation level has been confirmed in the vendor advisory or patch links.

Successful exploitation could lead to escalation of privilege by an unauthenticated attacker remotely, potentially compromising confidentiality and integrity of the affected system or data. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when handling custom URL schemes and restrict network exposure where possible. Monitor for vendor updates to apply official patches once available.